Recovering deleted SQLite records
SQLite databases store the deleted records within the database itself, so it is possible to recover deleted data, such as contacts, SMS, calendar, notes, e-mail and voicemail, and more by parsing the corresponding SQLite database. If a SQLite database is vacuumed or defragmented, the likelihood of recovering the deleted data is minimal. The amount of cleanup that these databases require relies heavily on the iOS version, the device, and the user's settings on the device.
A SQLite database file comprises one or more fixed size pages, which are used just once. SQLite uses a b-tree layout of pages to store indices and table content. Detailed information on the b-tree layout is explained at http://sandbox.dfrws.org/2011/fox-it/DFRWS2011_results/Report/Sqlite_carving_extractAndroidData.pdf ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access